Cybersecurity – SOC Lead (AI & Automation)

Offshore Hiring - India

Location: Mumbai(Seepz or Mahape)

SOC Lead 8-12 years India (Offshore Delivery Center) –

Afternoon / evening IST with daily overlap to U.S. Eastern time

Role Summary:

Lead offshore SOC execution, combining operational leadership, detection governance, case quality oversight, and practical automation. This role must drive disciplined day-to-day performance while improving the use of built-in AI / automation features across the security stack without sacrificing analyst judgement, traceability, or investigation fidelity.

You will lead a team of analysts in a 24x7 environment, specifically focusing on integrating Agentic AI to assist with visibility and alerting. This role is a unique blend of technical architecture and operational leadership across both IT and OT (Manufacturing) environments.

Key Responsibilities

- Lead the offshore SOC pod across L1 and L2 activities, ensure queue health, review investigation quality, and maintain strong stakeholder alignment with onshore security leadership.
- Directly manage a team of three service-provider analysts, ensuring high performance and strict alignment with organizational security standards.
- Own daily operational governance including case quality, severity calibration, shift handoffs, SLA adherence, and escalation discipline for major incidents.
- Lead the implementation and optimization of Splunk (launching in 90 days) to serve as the central nervous system for security visibility.
- Drive continuous improvement in Splunk ES / Mission Control operations, detection logic review, alert noise reduction, and visibility gap identification.
- Coordinate across CrowdStrike, Proofpoint, Qualys, Palo Alto, Dragos, ServiceNow, and automation workflows to improve response effectiveness.
- Utilize built-in AI capabilities within existing toolsets to automate L1/L2 alerting, ensuring that human response efforts are optimized for high-complexity investigations.
- Translate technical events into concise business risk language for U.S. stakeholders and support weekly service reviews, KPI reporting, and corrective action tracking.




- Promote responsible use of AI-assisted summarization, enrichment, and workflow acceleration within approved guardrails.
- Tool Environment

Splunk ES / Mission Control, CrowdStrike, Qualys, Proofpoint, Palo Alto, Dragos, ServiceNow, Teams,

M365 / Entra context, automation / SOAR capabilities where approved.

Required Experience & Skills

- Strong security operations leadership experience, including direct management of analysts or provider teams in a 24x7 or follow-the-sun model.
- Advanced proficiency in Splunk-based SOC operations and solid working knowledge of endpoint,

network, email, and vulnerability telemetry.
- Advanced proficiency in Splunk, CrowdStrike, and Qualys.
- Ability to coach analysts, review investigations, and enforce consistent case quality and operational rigor.
- Strong executive-facing communication and ability to run governance reviews with facts, metrics, and remediation actions.
- Experience working with offshore teams serving U.S.-based stakeholders.

Preferred Qualifications

- Manufacturing / OT security exposure, especially where corporate-to-plant visibility and escalation discipline matter.
- Familiarity with Dragos for manufacturing security is highly preferred.
- Experience with ServiceNow workflows, playbook optimization, and approved automation / SOAR patterns.
- Awareness of MITRE ATT&CK-aligned; detection engineering and risk-based incident prioritization.
- Operating Model & Working Requirements

Offshore India Operating Model

- Work as an embedded offshore team member supporting U.S.-based stakeholders with dependable daily communication, disciplined documentation, and clear ownership of actions and follow-ups.
- Operate with strong handoff hygiene across shifts, including concise status updates, ticket notes,

evidence capture,



and risk-based escalation to onshore leads.
- Support a manufacturing-aware operating model where uptime, safety, OT change sensitivity, and controlled execution are treated as essential requirements.
- Use ServiceNow and Microsoft Teams effectively for workflow coordination, incident tracking,

approvals, and stakeholder communication.
- Be prepared to align with late afternoon / evening IST overlap with U.S. Eastern time and participate in critical incident bridges when required.

Working Hours & Availability
- Working Hours: This role operates during EST business hours to ensure seamless alignment with US stakeholders.
- Availability: Must be available for 24x7 escalation support as needed.
- Success Measures
- Reliable, measurable SOC operations with better case quality, tighter escalation hygiene, and improved visibility coverage.
- Documented reduction in alert noise and stronger detection fidelity across the security stack.
- Clear governance cadence and dependable offshore team performance.
- Disclaimer

Employees must be able to perform the essential functions of this position satisfactorily. The requirements listed are representative of the duties, knowledge, skills, and/or abilities required. Reasonable accommodations may be requested by employees with disabilities, to enable them to perform the essential functions. The Company is committed to engaging in an interactive dialogue with employees relating to reasonable accommodations.

This is intended to set forth the essential functions required for this position and describe the general nature of the work performed by employees in this position. It may not contain an exhaustive inventory of all duties,

responsibilities, and qualifications required of employees to do this job. Employees may be assigned additional responsibilities as necessary. The Company reserves the right to revise this at any time and to require employees to perform other tasks based on changes in circumstances or conditions of the Company’s business,

competitive considerations, or the work environment. This document is not an employment contract.

📌 SOC Lead (Mumbai)
🏢 TechClub
📍 Mumbai